This was made obsoleten in 3.5.0 when crywrap was removed from the
GnuTLS source tree.
(From OE-Core rev: b49dc6f29533ab7debd299419c8b891e106f5d9d)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Don't always build the tests in do_compile, use do_compile_ptest so they
are only built when needed.
(From OE-Core rev: 5f4b10a3361e273d22bc880b4127eb53291be47d)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of using an internal ASN.1 parser, re-use libtasn1 from the
system by default.
(From OE-Core rev: db20ffc4ffb5e734258f0a9f9d1fb72d1f0df490)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GnuTLS has optional support for certificate compression. These are not
widely enabled in other distributions and were previously disabled in
standard builds, so don't enable them by default.
(From OE-Core rev: d22a406e7ca3018e0d1c0a7b1b6254c2aba6faba)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
DANE (DNS-based Authentication of Named Entities) allows certificates to
be bound to DNS entries.
This requires unbound which is not part of oe-core. Add a PACKAGECONFIG
but disable by default.
(From OE-Core rev: cfb328b2a7c35a8c1e0dd7cd8c7552a0837db206)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add dependency on python3 to fix execution in minimal images.
(From OE-Core rev: bf5b15a8b7a2b2276109efc8a6fe54788908ef0d)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add gnutls unit-tests into ptest. Only self-contained
tests (no external file system dependencies) are included.
Some tests have been put in a disallow list in the run-ptest;
these tests either require additional files (certificates) or
environment setup prior to being run, via wrapper shell script.
As autotools packages are built out-of-tree, it is cumbersome
to add additional files. With regards to tests requiring wrapper
scripts, it is possible to add logic to run these tests under
run-ptests but that will require more effort to maintain, hence
skipped.
Verified via:
$ runqemu qemux86-64 kvm nographic serial qemuparams='-m 4096 -smp 32'
root@qemux86-64:~# ptest-runner gnutls
START: ptest-runner
BEGIN: /usr/lib64/gnutls/ptest
PASS: aead-cipher-vec
PASS: alerts
PASS: anti_replay
...
gnutls test summary:
--------------------
total: 375
pass : 364
fail : 0
skip : 11
DURATION: 184
END: /usr/lib64/gnutls/ptest
2023-02-01T13:55
STOP: ptest-runner
TOTAL: 1 FAIL: 0
(From OE-Core rev: 6061df3084b991ba4a54a3dca5dadda97e2364ac)
Signed-off-by: Ravineet Singh <ravineet.a.singh@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
=========
** libgnutls: In FIPS140 mode, RSA signature verification is an approved
operation if the key has modulus with known sizes (1024, 1280,
1536, and 1792 bits), in addition to any modulus sizes larger than
2048 bits, according to SP800-131A rev2.
** libgnutls: gnutls_session_channel_binding performs additional checks when
GNUTLS_CB_TLS_EXPORTER is requested. According to RFC9622 4.2, the
"tls-exporter" channel binding is only usable when the handshake is
bound to a unique master secret (i.e., either TLS 1.3 or extended
master secret extension is negotiated). Otherwise the function now
returns error.
** libgnutls: usage of the following functions, which are designed to
loosen restrictions imposed by allowlisting mode of configuration,
has been additionally restricted. Invoking them is now only allowed
if system-wide TLS priority string has not been initialized yet:
gnutls_digest_set_secure
gnutls_sign_set_secure
gnutls_sign_set_secure_for_certs
gnutls_protocol_set_enabled
(From OE-Core rev: 858886aa07d0c2c2ef2489996cc8eca5fbe931fa)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
create-spdx can't detect the license properly if the case doesn't
match, so fix it.
(From OE-Core rev: 9c87828493784d996910d742006268a626ef0130)
Signed-off-by: Keiya Nobuta <nobuta.keiya@fujitsu.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Added a patch to avoid excute fipshmac command. Because *.hmac
file should be created on target instead of on build environment.
- Added pkg_postinst_ontarget to make sure necessary files are
created on target.
(From OE-Core rev: 1b5c620d10aa678871b6cea46e113c8fe3b79822)
Signed-off-by: Lei Maohui <leimaohui@fujitsu.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.
(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This ensures that if libseccomp is installed on build host then it does
not resort to use it.
Fixes
checking for libseccomp... (cached) yes
checking how to link with libseccomp... /usr/lib/libseccomp.so
(From OE-Core rev: 3751ac58720a500e3b749b2296922d7c82db49a1)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* it will try to link with librt from host and if you have it on host (libc6-dev-i386 in ubuntu)
it fails with:
/usr/lib32/librt.so: error: undefined reference to '__clock_settime', version 'GLIBC_PRIVATE'
/usr/lib32/librt.so: error: undefined reference to '__clock_getcpuclockid', version 'GLIBC_PRIVATE'
/usr/lib32/librt.so: error: undefined reference to '__clock_getres', version 'GLIBC_PRIVATE'
/usr/lib32/librt.so: error: undefined reference to '__clock_nanosleep', version 'GLIBC_PRIVATE'
collect2: error: ld returned 1 exit status
in older 3.6.14 it was using /usr/lib32/librt.so from host as well, but without do_compile
failing
configure:17539: checking for librt
configure:17563: i686-oe-linux-gcc -m32 -march=core2 -mtune=core2 -msse3 -mfpmath=sse -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type --sysroot=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.14-r0/recipe-sysroot -o conftest -O2 -pipe -g -feliminate-unused-debug-types -fmacro-prefix-map=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.14-r0=/usr/src/debug/gnutls/3.6.14-r0 -fdebug-prefix-map=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.14-r0=/usr/src/debug/gnutls/3.6.14-r0 -fdebug-prefix-map=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.14-r0/recipe-sysroot= -fdebug-prefix-map=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.14-r0/recipe-sysroot-native= -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -Wl,-z,relro,-z,now conftest.c /usr/lib32/librt.so >&5
configure:17563: $? = 0
configure:17573: result: yes
configure:17580: checking how to link with librt
configure:17582: result: /usr/lib32/librt.so
with --with-librt-prefix passed, it finds the right one as shown in build/config.log:
configure:17551: checking for librt
configure:17575: i686-oe-linux-gcc -m32 -march=core2 -mtune=core2 -msse3 -mfpmath=sse -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type --sysroot=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.15-r0/recipe-sysroot -o conftest -O2 -pipe -g -feliminate-unused-debug-types -fmacro-prefix-map=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.15-r0=/usr/src/debug/gnutls/3.6.15-r0 -fdebug-prefix-map=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.15-r0=/usr/src/debug/gnutls/3.6.15-r0 -fdebug-prefix-map=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.15-r0/recipe-sysroot= -fdebug-prefix-map=/tmpdir/work/qemux86-oe-linux/gnutls/3.6.15-r0/recipe-sysroot-native= -I/tmpdir/work/qemux86-oe-linux/gnutls/3.6.15-r0/recipe-sysroot/usr/include -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -Wl,-z,relro,-z,now conftest.c /tmpdir/work/qemux86-oe-linux/gnutls/3.6.15-r0/recipe-sysroot/usr/lib/librt.so >&5
configure:17575: $? = 0
configure:17585: result: yes
configure:17592: checking how to link with librt
configure:17594: result: /tmpdir/work/qemux86-oe-linux/gnutls/3.6.15-r0/recipe-sysroot/usr/lib/librt.so
(From OE-Core rev: d355cd38904460f3add2b0b9477e8ddfd42b22e1)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove backported patches and explicitly pass -std=gnu99 to native CFLAGS
to make sure build passes on older and still supported OSes like CentOS 7.
(From OE-Core rev: cc84d4dcc775c371389e1d351256946cbd003545)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop patch from 81485be19b ("gnutls: don't use HOSTTOOLS_DIR/bash as a
shell on target") as upstream now honours POSIX_SHELL when set as the
primary target shell.
(From OE-Core rev: bc487ced3be40569157fb40c99bfa68871f74744)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is required before enabling p11-kit support by default in gnutls.
(From OE-Core rev: 2a35202dbffd31eac1c00c03497549805853ad6c)
Signed-off-by: Philippe Normand <philn@igalia.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* For changes in this version, see:
https://gitlab.com/gnutls/libtasn1/-/releases
* Remove the musl patch as it's no longer needed.
* Backport a patch to ensure LDFLAGS are not over-ridden.
License-Update: License clarification, no change in actual terms.
(From OE-Core rev: 243293436d9286f6d9a0f135d569b7b00ccc1078)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The libopts configure script looks for a shell on the build host and assumes
it's good for the target. However in our builds it find $HOSTTOOLS_DIR/bash
which isn't useful, so patch out the detection and force $base_bindir/sh.
(From OE-Core rev: 9aaa1e3bdfd767fe8e19c00c611b34920644df27)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since version 2.58 the glib-networking TLS database relies on GnuTLS's system
trust store, so not enabling it leads to TLS errors in applications depending on
glib-networking. The raised runtime warning is:
process:500): GLib-Net-WARNING **: 09:14:09.321: Failed to load TLS database: Failed to load system trust store: GnuTLS was not configured with a system trust
(app:490): ... TLS Error: TLS certificate has unknown CA.
(From OE-Core rev: 1d147be584d2f016853edbe9751247d7daa0b5d0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a new upstream release from the same stable branch
bringing new features and bugfixes (including CVE fixes).
COPYING changed http -> https.
configure no longer has a --without-libunistring-prefix option.
(From OE-Core rev: 64d1a8be539c003d920b33fd1ae1846da5bd99f9)
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This recipe doesn't ship a *-config binary, so don't inherit binconfig.
(From OE-Core rev: acfcebec2d0849cc52abed31663da888e2a230f9)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This recipe doesn't ship a *-config binary, so don't inherit binconfig.
(From OE-Core rev: 8b7d74aa7bb73daf84593fafde3eef4595918b63)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
